Package: apksigner
Version: 35.0.2-1
Severity: normal
Dear Maintainer,
I noticed that apksigner depends on default-jre, although it is a command line
tool for signing and verifying APKs. On a minimal headless installation, this
dependency causes APT to install the GUI capable Java runtime and its
additional dependencies.
apksigner works correctly without installing the full default-jre, only with
default-jre-headless runtime, manually tested.
I then inspected the Debian source package android-platform-tools-apksig
(35.0.2-1) to identify the source of the dependency.
The relevant part of debian/rules is:
export JAVA_HOME=/usr/lib/jvm/default-java
The executable JAR is built using jh_build, and its manifest contains:
Debian-Java-Home: /usr/lib/jvm/default-java
Main-Class: com.android.apksigner.ApkSignerTool
In the installed javahelper 0.80, jh_build sets the Debian-Java-Home manifest
attribute from JAVA_HOME:
$main_section->set_value('Debian-Java-Home', $JAVA_HOME);
jh_depends subsequently reads this attribute:
JHOME=""extractline META-INF/MANIFEST.MF Debian-Java-Home""
JVM=""home-to-jvm "$JHOME"""
The resulting JVM identifier is "default". Since no headless modifier is
selected, jh_depends generates the dependency on default-jre:
JVMDEPS="default-jre$headless $alternateversiondeps "
The binary package's debian/control contains:
Depends: ${misc:Depends}, ${java:Depends}
This allows the generated dependency to be incorporated into the final package.
A runtime tests indicate that apksigner does not require the GUI capable
runtime for its CLI functionality.
Debian Java Policy ยง2.3 states that Java programs must depend on the required
runtime environment, using default-jre or default-jre-headless depending on
whether a GUI is needed.
I'm not sure that apksigner is the only that have this problem in its metadata
or in other packages also.
Could the runtime dependency be generated using the headless option instead?
This would avoid requiring the GUI capable Java runtime on headless systems,
including minimal containers and automated Android signing environments.
Thank you for your time.
-krecod
